File name:

request[1].exe

Full analysis: https://app.any.run/tasks/bdc872b1-2e49-4d27-8f05-b4fdedc63b04
Verdict: Malicious activity
Analysis date: August 11, 2024, 00:59:34
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

89ABCAF55AA838CF15D21681C4C33BAE

SHA1:

5D9236C09A6ADBE64E0086683515BE8604590B53

SHA256:

96D7707E2B2063ABC9454CD57E9A1A08038D2DA9145410A398B1BA12E3272393

SSDEEP:

6144:SUQVXHIIooTXj1HN2g5OHThRYOe65UPP63nrgjQU:vQVXHIoThHcg5ehRYOn5SP+y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • request[1].exe (PID: 6292)
      • msvcservice.exe (PID: 6560)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • request[1].exe (PID: 6292)

    • Drops the executable file immediately after the start

      • request[1].exe (PID: 6292)

    • Reads security settings of Internet Explorer

      • request[1].exe (PID: 6292)
      • msvcservice.exe (PID: 6560)

    • Reads the date of Windows installation

      • request[1].exe (PID: 6292)

    • Starts itself from another location

      • request[1].exe (PID: 6292)

    • Checks for external IP

      • svchost.exe (PID: 2256)

    • Executes application which crashes

      • msvcservice.exe (PID: 6560)

    • Checks Windows Trust Settings

      • msvcservice.exe (PID: 6560)

    • Connects to unusual port

      • msvcservice.exe (PID: 6560)

  • INFO

    • Process checks computer location settings

      • request[1].exe (PID: 6292)

    • Reads the computer name

      • request[1].exe (PID: 6292)
      • msvcservice.exe (PID: 6560)

    • Checks supported languages

      • request[1].exe (PID: 6292)
      • msvcservice.exe (PID: 6560)

    • Checks proxy server information

      • msvcservice.exe (PID: 6560)
      • WerFault.exe (PID: 6836)

    • Reads the machine GUID from the registry

      • msvcservice.exe (PID: 6560)

    • Reads the software policy settings

      • msvcservice.exe (PID: 6560)
      • WerFault.exe (PID: 6836)

    • Creates files or folders in the user directory

      • msvcservice.exe (PID: 6560)
      • WerFault.exe (PID: 6836)

    • Reads Environment values

      • msvcservice.exe (PID: 6560)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:08:11 00:45:46+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 233472
InitializedDataSize: 82944
UninitializedDataSize: -
EntryPoint: 0x1c60a
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
4
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start request[1].exe msvcservice.exe svchost.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6292"C:\Users\admin\Desktop\request[1].exe" C:\Users\admin\Desktop\request[1].exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\request[1].exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6560"C:\Users\admin\msvcservice.exe" C:\Users\admin\msvcservice.exe
request[1].exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226356
Modules
Images
c:\users\admin\msvcservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6836C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6560 -s 1236C:\Windows\SysWOW64\WerFault.exe
msvcservice.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
8 359
Read events
8 337
Write events
22
Delete events
0

Modification events

(PID) Process:(6292) request[1].exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:msvcservice
Value:
C:\Users\admin\msvcservice.exe
(PID) Process:(6292) request[1].exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6292) request[1].exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6292) request[1].exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6292) request[1].exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6560) msvcservice.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:msvcservice
Value:
C:\Users\admin\msvcservice.exe
(PID) Process:(6560) msvcservice.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6560) msvcservice.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6560) msvcservice.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6560) msvcservice.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
1
Suspicious files
7
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6836WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_msvcservice.exe_694d2377becb15dc7221bc6dbae286c7bfcba_d2a3ded1_0fb35b72-9479-4aa9-b6ce-d0290edcce7a\Report.wer —
MD5:—
SHA256:—
6292request[1].exeC:\Users\admin\msvcservice.exeexecutable
MD5:89ABCAF55AA838CF15D21681C4C33BAE
SHA256:96D7707E2B2063ABC9454CD57E9A1A08038D2DA9145410A398B1BA12E3272393
6836WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERBF36.tmp.WERInternalMetadata.xmlxml
MD5:6264FBC04554FE9FF1A55022E492B502
SHA256:EC638A856630A5EE2CB84294275C8ACBD11EE25DEC6E93BE3141CC93181664F1
6560msvcservice.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:3DFCA46E00FFA4795C72A41375F159D3
SHA256:DCBA1A505396539BAC40A7253C9F5DCCF06CBB79957E21D56305E1FC3AF5F40E
6560msvcservice.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F1AB2F3FB189DFFD271A047C733EBAF3binary
MD5:5C89BEF01D32F33B7EF91A9060B4D9BA
SHA256:22542427552C5DFC746A52620888AE880C66D3B11E9EE75CA5B6655D467C0010
6836WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERBF66.tmp.xmlxml
MD5:4950CC40BB6FB83B17B80F187BCBEC6D
SHA256:778028D9C612DAF557107220FE5FAE1AAA3F725CF76FB6AA023C6755E8712226
6836WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\msvcservice.exe.6560.dmpbinary
MD5:E582F8014D03AFF470712A81C46F3F82
SHA256:04BDB69B3F5EDB87C7A3C4127FE44C3AA253F5346BF18F465D25001F0E5B1341
6836WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERBE5A.tmp.dmpbinary
MD5:ED2BFCDCB0DE451E337251E2623F3559
SHA256:6225B0E0665A1C7D23424C324EEDF3351C7A0E222202B90B7EC3895359B6954E
6836WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:82C30E45BF5F93A5DB1D5E47F913053B
SHA256:2C6BBFF9207065E8800C4AF0CB2748818ABB3CFFC0D6D518FE17F76A232F8967
6836WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:FB64A9EBEDF48D3895381D5B7D80743D
SHA256:EA21D495930AD76F267A33A0F593DBF0C7EA75E457FCAE49A29DAAD8BD920F42
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
42
DNS requests
19
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6560
msvcservice.exe
GET
200
95.101.54.131:80
http://r11.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgTYzwVaSN4Tq1va7AvrTybTcg%3D%3D
unknown
—
—
whitelisted
6888
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3812
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6952
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2536
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2272
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6560
msvcservice.exe
212.132.117.42:443
ip-api.io
RM Education Ltd
GB
unknown
6560
msvcservice.exe
95.101.54.131:80
r11.o.lencr.org
Akamai International B.V.
DE
unknown
6560
msvcservice.exe
185.208.158.114:40050
—
—
US
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2536
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.238
whitelisted
ip-api.io
  • 212.132.117.42
unknown
r11.o.lencr.org
  • 95.101.54.131
  • 2.16.202.121
whitelisted
www.bing.com
  • 2.23.209.133
  • 2.23.209.187
  • 2.23.209.182
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.67
  • 20.190.159.4
  • 20.190.159.23
  • 20.190.159.68
  • 20.190.159.0
  • 20.190.159.64
  • 20.190.159.73
whitelisted
th.bing.com
  • 2.23.209.187
  • 2.23.209.182
  • 2.23.209.149
  • 2.23.209.133
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain (ip-api .io) in DNS Lookup
6560
msvcservice.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
request[1].exe